full-disclosure - Re: Enable secret 5 : Cisco Password

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date: Wed, 23 May 2007 14:14:19 -0700
From: coderman <coderman@...il.com>
To: "Michael Holstein" <michael.holstein@...ohio.edu>
Cc: full-disclosure@...ts.grok.org.uk
Subject: Re: Enable secret 5 : Cisco Password

On 5/23/07, Michael Holstein <michael.holstein@...ohio.edu> wrote:
> > Dork, show me a full set of a-zA-Z0-9{8} rainbow tables with salted
> > md5 and I will show you a picture of me in a bathing suit.
>
> My *point* was that a rainbow attack against is a lot faster than a
> brute-force with JTR or similar. Might as well try the easier options first.

what Knud was indicating is that rainbow tables work against unsalted
(or minimally salted) targets.  for example, lanman is a great target
- it uses md5, but does not salt.  if you have 200G to spare, this
works great.

properly salted md5 is immune to rainbow table attacks.

(now, as for generating collisions, there have been some nice advances
in md5 tunneling attacks, but the cost is still too large for targeted
md5 collisions iirc.  someone will correct me if i'm wrong, i'm
sure...)

best regards,

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/